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MEMORANDUM OF THE UNITED STATES 
IN RESPONSE TO THE COURTS ORDER DATED JANAURY 28, 2009 (U) 

The United States of America, by and through the undersigned Department of 
Justice attorneys, respectfully submits this memorandum and supporting Declaration of 
Lt. General Keith B, Alexander, U.S. Army, Director, National Security Agency (NSA), 
attached hereto at Tab 1 ("Alexander Declaration"), in response to the Court's Order 
Regarding Preliminary Notice of Compliance Incident Dated January 15, 2009 ("January 
28 Order") T(TS)^^ 

The Government acknowledges that NSA's descriptions to the Court of tire alert 
list process described in the Alexander Declaration were inaccurate and that the 
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Business Records Order did not provide the Government with authority to employ the 
alert list in the manner in which it did. (TS//SI//NF) — 

For the reasons set forth below, however, the Court should not rescind or modify 
its Order in docket number BR 08-13. The Government has already taken significant 
steps to remedy the alert list compliance incident and has commenced a broader review 
of its handling of the metadata collected in this matter. In addition, die Government is 
taking additional steps to implement a more robust oversight regime. Finally, the 
Government respectfully submits that the Court need not take any further remedial 
action, including through the use of its contempt powers or by a referral to the 
appropriate investigative offices . 1 -4 TS//SI//NF) 

BACKGROUND (U) 

I. Events Preceding the Court's January 28 Order (5)\ 

In docket number BR 06-05, the Government sought, and the Court authorized 

NSA, pursuant to the Foreign Intelligence Surveillance Act's (FISA) tangible things 

provision, 50 U.S.C, § 1861 et seq„ to collect in bulk and on an ongoing basis certain call 



1 The January 28 Order directed the Government to file a brief to help the Court assess 
how to respond to this matter and to address seven specific issues. This memorandum 
discusses the need for further Court action based, in part, on the facts in the Alexander 
Declaration, which contains detailed responses to each-of the Court's specific questions. See 
Alexander Decl. at 24-39.'"(Sk 
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detail records or "telephony metadata/' so that NSA could analyze the metadata using 



contact chainin 




tools. 2 (T5//SI//NF) 



FISA's tangible things provision authorizes the Director of the Federal Bureau of 



Investigation (FBI) or Ms designee to apply to this Court 

for an order requiring the production of any tangible things (including 
books, records, papers, documents, and other items) for an investigation 
to obtain foreign intelligence information not concerning a United States 
person or to protect against international terrorism or clandestine 
intelligence activities, provided that such investigation of a United States 
person is not conducted solely on the basis of activities protected by the 
first amendment to the Constitution. 

50 U.S.C. § 1861(a)(1). FISA's tangible things provision directs the Court to enter an ex 



parte order requiring the production of tangible things and directing that the tangible 
things produced in response to such an order be treated in accordance with 
minimization procedures adopted by the Attorney General pursuant to section 1861(g), 



if the judge finds that the Government's application meets the requirements of 50 U.S.C. 
§ 1861(a) & (b). See 50 U.S.C. § 1861(c)(1). (U) 

In docket number BR 06-05 and each subsequent authorization, including docket 
number BR 08-13, tills Court found that the Government's application met the 
requirements of 50 U.S.C. § 1861(a) & (b) and entered an order directing that the BR 
metadata to be produced— call detail records or telephony metadata— be treated in 



2 The Government will refer herein to call dg-tailrecords collected pursuant to the 
Court's authorizations in this matter as "BR metadata." (IS) — 
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accordance with the minimization procedures adopted by the Attorney General. 



Among these minimization procedures was the following: 



Any search or analysis of the data archive shall occur only after a 
particular known teleghon^mmber has been associated with | 

|j 3] jyj- ore S p ec ig ca ]]y / access to the 
archived data shall occur only when NS A has identified a known 
telephone number for which, based on the factual and practical 
considerations of everyday life on which reasonable and prudent persons 
act, there are facts giving rise to a reasonable, articulable suspicion that the 
telephone number is associated with 

organization; provided, however, that a telephone number believed to be 
used by a U.S. person shall not be regarded as associated with 

solely on the basis of activities that are 

protected by the First Amendment to the Constitution. 



Order, docket number BR 06-05, at 5 (emphasis added); see also Memo, of Law in Supp. 
of Application for Certain Tangible Things for Investigations to Protect Against 
International Terrorism, docket number BR 06-05, Ex. C, at 20 (describing the above 
requirement as one of several minimization procedures to be applied to the collected 
metadata). 4 - - (T5//SV/NF) 



3 Authorizations after this matter was initiated in May 2006 expanded the telephone 

identifiers that NSA could query to those identifiers associated 

generally docket number BR 06-05 (motion to amend granted in August 2006), and 

later see generally do dee t number 

BR 07-10 (motion to amend granted in June 2007). The Court' s authorization in docket number 
BR 08-13 approved querying related tc 

Primary Order, dodeet number 

BR 08-13, at 8. (T0//PI//NJ) 



4 In addition, the Court's Order in docket number BR 06-05 and each subsequent 
authorization, inducting docket number BR 08-13, required that "[ajlthough the data collected 
under this Order will necessarily be broad, the use of that information for analysis shall be 
strictly tailored to identifying terrorist communications and shall occur solely according to the 

nr rn T?T 'ir m f t mt/zmofor m//mb 
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On December 11, 2008, the Court granted the most recent reauthorization of the 
BR metadata collection. For purposes of querying the BR metadata, as in prior Orders 
in this matter, the Court required the Government to comply with the same standard of 
reasonable, articulable suspicion set forth above. Primary Order, docket number BR 08- 
13, at 8-9. 5 — (¥S// 5I//NF) 

On January 9, 2009, representatives from the Department of Justice's National 
Security Division (NSD) attended a briefing at NSA concerning the telephony metadata 
collection. 6 At the briefing, NSD and NSA representatives discussed several matters, 
including the alert list. See Alexander Deck at 17, 27-28. Following the briefing and on 
the same day, NSD sent NSA an e-mail message asking NSA to confirm NSD's 
understanding of how the alert list operated as described at the briefing. Following 
additional investigation and the collection of additional information, NSA replied on ■ 



procedures described in the application, including the minimization procedures designed to 
protect U.S. person information/'' See, e.g.. Order, docket number BR 06-05, at 6 1 D. 

— (-TS//ST//MF) . 

5 In this memorandum the Government will refer to this standard as the "RAS standard" 
and telephone identifiers that satisfy the standard as "RAS-approved." (SJ^ 

6 Hie names of the Department of Justice representatives who attended the briefing are 
included in the Alexander Declaration at page 28. The date of this meeting, January 9, 2009, 
was the date on which these individuals first learned (later confirmed) that the alert list 
compared non-RAS-approved identifiers to the incoming BR metadata. Other than these 
individuals (and other NSD personnel with whom these individuals discussed this matter 
between January 9 and January 15, 2009), and those NSA personnel otherwise identified in the 
Alexander Declaration, NSD has no record of any other executive branch personnel who knew 
that the alert list included non-RAS-approved identifiers prior to January 15, 2009."7T5//SI//NEJ___ 
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January 14, 2009, confirming much of NSD's understanding and providing some 
additional information. See id. at 27. 

Following additional discussions between NSD and NSA, a preliminary notice of 
compliance incident was filed with the Court on January 15, 2009. See id, at 27-28. The 
letter reported that the alert list contained counterterrorism-associated telephone 
identifiers tasked for collection pursuant to NSA's signals intelligence (SIGINT) 
authorities under Executive Order 12333, and therefore included telephone identifiers 
that were not RAS-approved, as well as some that were. 7 Thereafter, as previously 
reported in a supplemental notice of compliance incident filed with the Court on 
February 3, 2009, NSA unsuccessfully attempted to complete a software fix to the alert 
list process so that it comported with the above requirement in docket number BR 08-13. 



7 The preliminary notice of compliance incident filed on January 15, 2009, stated in 
pertinent part: 

NSA informed the NSD that NSA places on the alert list counterterrorism 
associated telephone identifiers that have been tasked for collection pursuant to 
NSA's signals intelligence (SIGINT) authorities under Executive Order 12333. 
Because the alert list consists of SIGINT-tasked telephone identifiers, it contains 
telephone identifiers as to which NSA has not yet determined that a reasonable 
and articulable suspicion exists that they are associated wi 




As information collected pursuant the Couth s Orders in 
this matter flows into an NSA database, NSA automatically compares this 
information with its alert list in order to identify U.S. telephone identifiers that 
have been in contact with a number on the alert list. Based on results of this 
comparison NSA then determines in what body of data contact chaining is 
authorized. 



Jan. 15, 2009, Preliminary Notice of Compliance Incident, docket number 08-13, at 2. 
(TS//5I//NF) 
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